avcodec/hevc: Check num_entry_point_offsets
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 13 May 2015 11:21:52 +0000 (13:21 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 13 May 2015 12:26:17 +0000 (14:26 +0200)
Fixes CID1239099 part 2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/hevc.c

index dc7cabb..54cb341 100644 (file)
@@ -707,7 +707,14 @@ static int hls_slice_header(HEVCContext *s)
 
     sh->num_entry_point_offsets = 0;
     if (s->pps->tiles_enabled_flag || s->pps->entropy_coding_sync_enabled_flag) {
-        sh->num_entry_point_offsets = get_ue_golomb_long(gb);
+        unsigned num_entry_point_offsets = get_ue_golomb_long(gb);
+        // It would be possible to bound this tighter but this here is simpler
+        if (sh->num_entry_point_offsets > get_bits_left(gb)) {
+            av_log(s->avctx, AV_LOG_ERROR, "num_entry_point_offsets %d is invalid\n", num_entry_point_offsets);
+            return AVERROR_INVALIDDATA;
+        }
+
+        sh->num_entry_point_offsets = num_entry_point_offsets;
         if (sh->num_entry_point_offsets > 0) {
             int offset_len = get_ue_golomb_long(gb) + 1;
             int segments = offset_len >> 4;